Hi,
We're trying to get aaa failed/passed authentications, guest registrations etc. to a remote syslog-server. Following the documentation, everything looks good - the problem is the syslog isnt receiving very many messages. It gets some, but those messages are from categories the new syslog isnt even a member of.
Oct 11 05:00:00 so8-ise-admin-001 CISE_MONITORING_DATA_PURGE_AUDIT 2017-10-11 04:10:32.457 +0200 60198 INFO Administrative and Operational Audit: MnT purge event occurred, MESSAGE=purging Radius data older than 11-SEP-17,
Oct 11 05:00:00 so8-ise-admin-001 CISE_MONITORING_DATA_PURGE_AUDIT 2017-10-11 04:13:26.688 +0200 60198 INFO Administrative and Operational Audit: MnT purge event occurred, MESSAGE=purge skipped; no data available for 11-SEP-17,
Oct 11 05:00:00 so8-ise-admin-001 CISE_MONITORING_DATA_PURGE_AUDIT 2017-10-11 04:01:45.093 +0200 60198 INFO Administrative and Operational Audit: MnT purge event occurred, MESSAGE=Tacacs Data threshold_space = 33 GB, used_space = 0 GB,
Oct 11 05:00:00 so8-ise-admin-001 CISE_MONITORING_DATA_PURGE_AUDIT 2017-10-11 04:01:57.098 +0200 60198 INFO Administrative and Operational Audit: MnT purge event occurred, MESSAGE=purging Tacacs data older than 11-SEP-17,
The category Administrative and Operational Audit only has two members, and those are the two ISE-deployment monitoring nodes - not the the new syslo-server. Anyone have any tips? Weird that im getting some messages, but not the ones i want. Do i need to reboot the admin-node?
